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Abstract 

The problem of error-control in random linear network coding is considered. A 
"noncoherent" or "channel oblivious" model is assumed where neither transmitter nor 
receiver is assumed to have knowledge of the channel transfer characteristic. Motivated 
by the property that linear network coding is vector-space preserving, information 
transmission is modelled as the injection into the network of a basis for a vector space 
V and the collection by the receiver of a basis for a vector space U. A metric on the 
projective geometry associated with the packet space is introduced, and it is shown that 
a minimum distance decoder for this metric achieves correct decoding if the dimension 
of the space V f)U is sufficiently large. If the dimension of each codeword is restricted to 
a fixed integer, the code forms a subset of a finite-field Grassmannian, or, equivalently, 
a subset of the vertices of the corresponding Grassmann graph. Sphere-packing and 
sphere-covering bounds as well as a generalization of the Singleton bound are provided 
for such codes. Finally, a Reed-Solomon-like code construction, related to Gabidulin's 
construction of maximum rank-distance codes, is described and a Sudan-style "list-1" 
minimum distance decoding algorithm is provided. 
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1. Introduction 



Random network coding [1-3] is a powerful tool for disseminating information in networks, 
yet it is susceptible to packet transmission errors caused by noise or intentional jamming. 
Indeed, in the most naive implementations, a single error in one received packet would typ- 
ically render the entire transmission useless when the erroneous packet is combined with 
other received packets to deduce the transmitted message. It might also happen that insuffi- 
ciently many packets from one generation reach the intended receivers, so that the problem 
of deducing the information cannot be completed. 

In this paper we formulate a coding theory in the context of a "noncoherent" or "channel 
oblivious" transmission model for random linear network coding that captures the effects 
both of errors, i.e., erroneously received packets, and of erasures, i.e., insufficiently many 
received packets. We are partly motivated by the close analogy between the F g -linear channel 
produced in random linear network coding and the C-linear channel produced in noncoherent 
multiple-antenna channels [4], where neither the transmitter nor the receiver is assumed to 
have knowledge of the channel transfer characteristic. In contrast with previous approaches 
to error control in random linear network coding, e.g., [5-8], the noncoherent transmission 
strategy taken in this paper is oblivious to the underlying network topology and to the 
particular linear network coding operations performed at the various network nodes. Here, 
information is encoded in the choice at the transmitter of a vector space (not a vector), and 
the choice of vector space is conveyed via transmission of a generating set for the space. 

Just as codes defined on the complex Grassmann manifold play an important role in non- 
coherent multiple-antenna channels [4], we find that codes defined in an appropriate Grass- 
mannian associated with a vector space over a finite field play an important role here, but 
with a different metric associated with the structure of the corresponding Grassman graph. 

The standard, widely advocated approach to random linear network coding (see, e.g., [2]) 
involves transmission of packet "headers" that are used to record the particular linear com- 
bination of the components of the message present in each received packet. As we will 
show, this "uncoded" transmission may be viewed as a particular code of subspaces, but a 
"suboptimal" one, in the sense that the Grassmannian contains more spaces of a particular 
dimension than those obtained by prepending a header to the transmitted packets. Indeed, 
the very notion of a header or local and global encoding vectors, crucial in [2,3,8], is moot 
in our context. 

A somewhat more closely related approach is that of [9], which deals with reliable commu- 
nication in networks with so-called "Byzantine adversaries," who are are assumed to have 
some ability to inject packets into the network and sometimes also to eavesdrop (i.e., read 
packets transmitted in the network) [10]. It is shown that an optimal communication rate 
(which depends on the adversary's eavesdropping capability) is achievable with high prob- 
ability with codes of sufficiently long block length. The work of this paper, in contrast, 
concentrates more on the possibility of code constructions with a prescribed deterministic 
correction capability, which, however, asymptotically can achieve the same rates as would 
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be achieved in the so-called "omniscient adversary model" of [9]. 
The remainder of this paper is organized as follows. 

In Section [2J we introduce the "operator channel" as a concise and convenient abstraction 
of the channel encountered in random linear network coding, when neither transmitter nor 
receiver has knowledge of the channel transfer characteristics. The input and output alphabet 
for an operator channel is the projective geometry (the set of all subspaces) associated with 
a given vector space over a finite field ¥ q . In Section [31 we define a metric on this set that is 
natural and suitable in the context of random linear network coding. The transmitter selects 
a space V for transmission, indicating this choice by injection into the network of a set of 
packets that generate V. The receiver collects packets that span some received space U. We 
show that correct decoding is possible with a minimum distance decoder if the dimension of 
the space V D U is sufficiently large, just as correct decoding in the conventional Hamming 
metric is possible if the received vector u agrees with the transmitted vector v in sufficiently 
many coordinates. 

We will usually confine our attention to constant-dimension codes, i.e., codes in which all 
codewords have the same dimension. In this case, the code is a subset of the corresponding 
Grassmannian, or, equivalently, a subset of the vertices of the corresponding Grassmann 
graph. Coding in the Grassmann graph has been an active area of research in combinatorics 
[11-15], where the problem has been studied as a packing problem that arises naturally. In 
Section HI we derive elementary coding bounds, analogous to the sphere-packing (Hamming) 
upper bounds and the sphere-covering (Gilbert- Varshamov) lower bounds for such codes. By 
defining an appropriate notion of puncturing, we also derive a Singleton bound. Asymptotic 
versions of these bounds are also given. Some Johnson-type bounds on constant dimension 
codes can be found in [16]. 

A notable application for constant-dimension codes is their use as so-called linear authenti- 
cation codes introduced by Wang, Xing and Safavi-Naini [17]. There, the properties of codes 
in the Grassmann graphs are used to detect tampering with an authenticated message. The 
authors of [17] describe a construction by which constant-dimension codes that are suitable 
for linear authentication can be obtained from rank-distance codes, in particular from the 
maximum rank-distance codes of Gabidulin [18]. In Section Owe revisit this construction in 
the context of the coding metric defined in this paper, and we show that these codes achieve 
the Singleton bound asymptotically. The main result of Section [5] is the development of 
an efficient Sudan-style "list-1" minimum distance decoding algorithm for these codes. A 
related polynomial-reconstruction-based decoder for Gabidulin codes has been described by 
Loidreau [19]. The connection between rank-metric codes and a generalized rank-metric 
decoding problem induced by random linear network coding is explored in [20]. 
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2. Operator Channels 



We begin by formulating our problem for the case of a single unicast, i.e., communication 
between a single transmitter and a single receiver. Generalization to multicasting is straight- 
forward. 

To capture the essence of random linear network coding, recall [2, 3] that communication 
between transmitter and receiver occurs in a series of rounds or "generations;" during each 
generation, the transmitter injects a number of fixed-length packets into the network, each 
of which may be regarded as a row vector of length N over a finite field ¥ q . These packets 
propagate through the network, possibly passing through a number of intermediate nodes 
between transmitter and receiver. Whenever an intermediate node has an opportunity to 
send a packet, it creates a random F g -linear combination of the packets it has available and 
transmits this random combination. Finally, the receiver collects such randomly generated 
packets and tries to infer the set of packets injected into the network. There is no assumption 
here that the network operates synchronously or without delay or that the network is acyclic. 

The set of successful packet transmissions in a generation induces a directed multigraph with 
the same vertex set as the network, in which edges denote successful packet transmissions. 
The rate of information transmission (packets per generation) between the transmitter and 
the receiver is upper-bounded by the min-cut between these nodes, i.e., by the minimum 
number of edge deletions in the graph that would cause the separation of the transmitter 
and the receiver. It is known that random linear network coding in ¥ q is able to achieve a 
transmission rate that achieves the min-cut rate with probability approaching one as q — > oo 



Let {p\,P2, ■ ■ ■ ,Pm}, Pi G denote the set of injected vectors. In the error-free case, the 
receiver collects packets yj, j = 1,2, ... ,L where each yj is formed as yj = Y^hLi hj,iPi with 
unknown, randomly chosen coefficients hjj G ¥ q . 

We note that a priori L is not fixed and the receiver would normally collect as many packets 
as possible. However, as noted above, properties of the network such as the min-cut between 
the transmitter and the receiver may influence the joint distribution of the hij and, at some 
point, there will be no benefit from collecting further redundant information. 

If we choose to consider the injection of T erroneous packets, this model is enlarged to include 
error packets e t , t = 1, . . . , T to give 



where again g^ t G ¥ q are unknown random coefficients. Note that since these erroneous 
packets may be injected anywhere within the network, they may cause widespread error 
propagation. In particular, if ^ for all j, even a single error packet e\ has the potential 
to corrupt each and every received packet. 



[3]. 
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In matrix form, the transmission model may be written as 

y = Hp + Ge, (1) 

where H and G are random L x M and LxT matrices, respectively, p is the M x N matrix 
whose rows are the transmitted vectors, y is the L x N matrix whose rows are the received 
vectors, and e is the T x N matrix whose rows are the error vectors. 

The network topology will certainly impose some structure on the matrices H and G. For 
example, H may be rank-deficient if the min-cut between transmitter and receiver is not 
large enough to support the transmission of M independent packets during the lifetime of 
one generation^- While the possibility may exist to exploit the structure of the network, 
in the strategy adopted in this paper we do not take any possibly finer structure of the 
matrix H into account. Indeed, any such fine structure can be effectively obliterated by 
randomization at the source, i.e., if, rather than injecting packets Pi into the network, the 
transmitter were instead to inject random linear combinations of the pj. 

At this point, since H is random, we may ask what property of the injected sequence of 
packets remains invariant in the channel described by (pQ), even in the absence of noise 
(e = 0)? Since H is a random matrix, all that is fixed by the product Hp is the row space 
of p. Indeed, as far as the receiver is concerned, any of the possible generating sets for this 
space are equivalent. We are led, therefore, to consider information transmission not via the 
choice of p, but rather by the choice of the vector space spanned by the rows of p. This simple 
observation is at the heart of the channel models and transmission strategies considered in 
this paper. Indeed, with regard to the vector space selected by the transmitter, the only 
deleterious effect that a multiplication with H may have is that Hp may have smaller rank 
than p, due to, e.g., an insufficient min-cut or packet erasures, in which case Hp generates 
a subspace of the row space of p. 

Let W be a fixed iV-dimensional vector space over ¥ q . All transmitted and received packets 
will be vectors of W; however, we will describe a transmission model in terms of subspaces of 
W spanned by these packets. Let V(W) denote the set of all subspaces of W, an object often 
called the projective geometry of W. The dimension of an element V G V(W) is denoted 
as dim(V). The sum of two subspaces U and V of W is U + V — {u + v : u G U, v G V}. 
Equivalently, U + V is the smallest subspace ofW containing both U and V. If Uf)V — {0}, 
i.e., if U and V have trivial intersection, then the sum U + V is a direct sum, denoted as 
U © V. Clearly dim([7 © V) = dim(C/) + dim(V). For any subspaces U and V we have 
V — (U fl V) © V for some subspace V isomorphic to the quotient space V j (UflV). In this 
case, U + V = U + ((U n V) © V) = U © V. 

For integer k ^ 0, we define a stochastic operator TC k , called an "erasure operator," that 
operates on the subspaces of W. If dim(V) > k, then 7ik{V) returns a randomly chosen 
fc-dimensional subspace of V; otherwise, TCk(V) returns V. For the purposes of this paper, 

1 This statement can be made precise once the precise protocol for transmission of a generation has been 
fixed. However, for the purpose of this paper it is sufficient to summarily model "rank deficiency" as one 
potential cause of errors. 
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the distribution of TCk(V) is unimportant; for example, it could be chosen to be uniform. 
Given two subspaces U and V of W, it is always possible to realize U as U = TCk{V) © E for 
some subspace E of W, assuming that that k = dim(C/ D V) and that 7ik(U) realizes UnV. 

We define the following "operator channel" as a concise transmission model for network 
coding. 

Definition 1 An operator channel C associated with the ambient space W is a channel with 
input and output alphabet V(W). As described above, the channel input V and channel 
output U can always be related as 

U = H k (V)®E, (2) 

where k = dim(C7 n V) and E is an error space. In transforming V to U , we say that the 
operator channel commits p = dim(V) — k erasures and t = dim(.E') errors. 

Note that we have chosen to model the error space E as intersecting trivially with the 
transmitted subspace V, and thus the choice of E is not independent of V. However, if 
we were to model the received space as U — T~Ck(V) + E for an arbitrary error space E, 
then, since E always decomposes for some space E' as E — (E n V) E', we would get 
U = H k {V) + (E n V) © E' = H k '(V) © E' for some k' ^ k. In other words, components of 
an error space E that intersect with the transmitted space V would only be helpful, possibly 
decreasing the number of erasures seen by the receiver. 

In summary, an operator channel takes in a vector space and puts out another vector space, 
possibly with erasures (deletion of vectors from the transmitted space) or errors (addition 
of vectors to the transmitted space). 

This definition of an operator channel makes a very clear connection between network cod- 
ing and classical information theory. Indeed, an operator channel can be seen as a standard 
discrete memoryless channel with input and output alphabet V(W). By imposing a channel 
law, i.e., transition probabilities between spaces, it would (at least conceptually) be straight- 
forward to compute capacity, error exponents, etc. Indeed, only slight extensions would be 
necessary concerning the ergodic behavior of the channel. For the present paper we constrain 
our attention to the question of constructing good codes in V(W), which is an essentially 
combinatorial problem. The codes we construct may be regarded as "one-shot" codes, i.e., 
codes of length one, since the transmission of a codeword will induce exactly one use of the 
operator channel. 



3. Coding for Operator Channels 

Definition [1] concisely captures the effect of random linear network coding in the presence 
of networks with erasures, varying min-cuts and/or erroneous packets. Indeed, we will show 
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how to construct codes for this channel that correct combinations of errors and erasures. 
Before we give such a construction we need to define a suitable metric. 



3.1. A Metric on V(W) 

Let Z + denote the set of non-negative integers. We define a function d : V(W) xV(W) — > Z + 
by 

d(A,B):=dim(A + B)-6im(Ar\B). (3) 
Since dim(/l + B) = dim(A) + dim(B) — dim(A fl B), we may also write 

d(A,B) = dim(A) + dim(B) - 2 dim(A n B) 
= 2dim(A + B) - dim(A) - dim(B). 

The following lemma is a cornerstone for code design for the operator channel of Definition [TJ 
Lemma 1 The function 

d(A, B) := dim(A + B) - dim(A n B) 
is a metric for the space V(W). 

Proof. We need to check that for all subspaces A, B,X 6 V(W) we have: i) d(A,B) ^ 
with equality if and only if A = B, ii) d{A,B) = d(B,A), and iii) d(A, B) < d{A,X) + 
d(X,B). The first two conditions are clearly true and so we focus on the third condition, 
the triangle inequality. We have 

-(d(A,B)-d(A,X)-d(X,B)) = dim(A n X) + dim(5 n X) - dim(X) - dim(A n B) 

= dim(A n X + B n X) - dim(X) 
s . ' 

+ dim(A n B n X) - dim(A n B) 
s . ' 

< 0, 

where the first inequality follows from the property that AflX + BflX C X and the second 
inequality follows from the property that Ar\Br\X<OAr\B. | 

Remark: The fact that d(A, B) is a metric also follows from the fact that this quantity repre- 
sents the distance of a geodesic between A and B in the undirected Hasse graph representing 
the lattice of subspaces of W [11] partially ordered by inclusion, i.e., where X ^ Y if and 
only if X is a subspace of Y. In this graph, the vertices correspond to the elements of V(W) 
and an edge joins a subspace X with a subspace Y if and only if | dim(X) — dim(Y) | = 1 and 
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either X C Y or Y C X. Just as the hypercube provides the appropriate setting for coding 
in the Hamming metric, the undirected Hasse graph represents the appropriate setting for 
coding in the context considered here. | 

If a basis for W is fixed, then since W is an N- dimensional vector space over ¥ q , the elements 
of W may be represented by iV-tuples of F 9 -valued coordinates with respect to this basis. 
We take the usual inner product between vectors u = (ui, . . . , u^) and v = (v±, . . . , v^) as 
(u,v) = Y^H=i u i v i- If U is a /c-dimensional subspace of W, then the orthogonal subspace 

U ± = {veW :(u,v) = Q for all u e U} 

is a space of dimension N — k. It is well known that for any subspaces U and V of W that 
(C/ ± ) ± = c/, 

(U + 1/)^ = C/ ± n V ± , and (c/ n v) 1 - = u ± + v ± . 

It follows that 

d{U L ,V L ) = dim(C/ ± + V^) - dim(f/ ± n ^) 
= dim((C/ny) ± ) -dim((f/ + \/) ± ) 
= (iV - dim(C/ n F)) - (iV-dim(C/ + y)) 
= dim(C/ + - dim(C7 n 

= d(tf,V). (4) 

Thus the distance between subspaces U and V is perfectly mirrored by the distance between 
the orthogonal subspaces U 1 - and V ± . 



3.2. Codes 

Let W be an N- dimensional vector space over ¥ q . A code for an operator channel with 
ambient space W is simply a nonempty subset of V(W), i.e., a nonempty collection of 
subspaces of W. 

The size of a code C is denoted by |C|. The minimum distance of C is denoted by 

D(C):= min d(X,Y). 

The maximum dimension of the codewords of C is denoted by 

£(C) := max dim(X). 

XdzC 

If the dimension of each codeword of C is the same, then C is said to be a constant- dimension 
code. 

In analogy with the (n, /c, d) triple that describes the parameters of a classical linear error 
correcting code of length n, dimension k and minimum Hamming distance d, a code C for 
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an operator channel with an iV-dimensional ambient space over W q is said to be of type 
[N,£(C),\og q \C\,D(C)}. 

The complementary code corresponding to a code C is the code C 1 - = {U 1 - : U £ C} obtained 
from the orthogonal subspaces of the codewords of C. In view of (jlj), we have D(C ± ) = D{C). 
If C is a const ant- dimension code of type [N, £, M, D] , then C 1 - is a const ant- dimension code 
of type [N,N-£,M,D\. 

Before we study bounds and constructions of codes in V(W), we need a proper definition of 
rate. Let C C V(W) be a code of type [N, £, log„ To transmit a space V £ C would 

require the transmitter to inject up to £(C) (basis) vectors from V into the network, corre- 
sponding to the transmission of N£ g-ary symbols. This motivates the following definition. 

Definition 2 Let C be a code of type [N, £, log ? (|C|), D\. The normalized weight A, the rate 
R, and the normalized minimum distance 5ofC are defined as 

N N£ 2£ 1 

The parameters A, R and 5 are quite natural. The normalized weight A takes the role of 
the energy of a spherical code in Euclidean space, or the equivalent weight parameter for 
constant weight codes. As such A is naturally limited to the range [0,1]. For constant- 
dimension codes, just as in the case of const ant- weight codes, the interesting range can 
actually be limited to [0, |] as any code C with £ > N/2 corresponds to the complementary 
code C 1 - with £ < N/2 and having the identical distance properties. The definition of 5 gives 
a natural range of [0,1]. Indeed, a normalized distance of 1 could only be obtained by spaces 
having trivial intersection. The rate R of a code is restricted to the range [0, 1] , with a rate 
of 1 only being approachable for A —>■ 0. 

The fundamental code construction problem for the operator channel of Definition [T] thus 
becomes the determination of achievable tuples [A, R, 5} as the dimension of ambient space N 
becomes arbitrarily large. We note that this setup may lack physical reality since it assumes 
that the network can operate with arbitrarily long packets; thus we will try to express our 
results for finite length iV whenever possible. Furthermore, as noted above, the codes we 
consider here are "one-shot" codes that induce just a single use of the operator channel. In 
situations where the channel characteristics (such as the network min-cut) are time- varying, 
it may be interesting and useful to define codes that induce n uses of the operator channel, 
considering what performance is attainable as n — >• oo. We will not pursue this direction in 
this paper. 



3.3. Error and Erasure Correction 

A minimum distance decoder for a code C is one that takes the output U of an operator 
channel and returns a nearest codeword V £ C, i.e., a codeword V £ C satisfying, for all 
V £ C, d(U,V) < d(U,V). 
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The importance of the minimum distance D(C) for a code C C V(W) is given in the following 
theorem, which provides the combined error-and-erasure-correction capability of C under 
minimum distance decoding. Define (x) + as (x) + := max{0,x}. 

Theorem 2 Assume we use a code C for transmission over an operator channel. Let V G C 
be transmitted, and let 

U = H k (V)@E 

be received, where dim(E) = t. Let p = (£(C) — k)+ denote the maximum number of erasures 
induced by the channel. If 

2(t + p)<D(C), (5) 

then a minimum distance decoder for C will produce the transmitted space V from the 
received space U. 

Proof. Let V = TCk(V). From the triangle inequality we have d(V, U) ^ d(V, V) + 
d(V, U) < p + t. If T ^ V is any other codeword in C, then D(C) < d(V,T) ^ d(V, U) + 
d{U,T), from which it follows that d{U,T) > D(C) - d(V,U) > D(C) - {p + t). Provided 
that the inequality (jSJ) holds, then d(U, T) > d{U, V) and hence a minimum distance decoder 
must produce V. | 

Not surprisingly, given the symmetry in this setup between erasures (deletion of dimensions 
due to, e.g., an insufficient min-cut in the network or an unfortunate choice of coefficients 
in the random linear network code) and errors (insertion of dimensions due to errors or 
deliberate malfeasance), erasures and errors are equally costly to the decoder. This stands 
in apparent contrast with traditional error correction (where erasures cost less than errors); 
however, this difference is merely an accident of terminology. A perhaps more closely related 
classical concept would be that of "insertions" and "deletions" . 

If we can be sure that the projection operation is moot (expressed by choosing operator 
^dim(VK) which operates as an identity on each subspace of W) or that the network produces 
no errors (expressed by choosing the error space E = {0}), we get the following corollary. 

Corollary 3 Assume we use a code C for transmission over an operator channel where V G C 
is transmitted. If 

u = n Aim(w) (v) © E = V © E 

is received, and if2t < D(C) where dim(^) = t, then a minimum distance decoder for C will 
produce V . Symmetrically, if 

U = H k (V)®{0} = H k (V) 

is received, and if 2p < D(C) where p = (£(C) — k)+, then a minimum distance decoder for 
C will produce V. 

In other words, the first part of the corollary states that in the absence of erasures a minimum 
distance decoder uniquely corrects errors up to dimension 
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precisely in parallel to the standard error-correction situation. 
3.4. Constant-Dimension Codes 

In the context of network coding, it is natural to consider codes in which each codeword 
has the same dimension, as knowledge of the codeword dimension can be exploited by the 
decoder to initiate decoding. Const ant- dimension codes are analogous to constant-weight 
codes in Hamming space (in which every codeword has constant Hamming weight) or to 
spherical codes in Euclidean space (in which every codeword has constant energy). 

As noted above, when considering const ant- dimension codes we may restrict ourselves to 
codes of type [N, £, M, D] with t ^ N - £, since a code of type [N, £, M, D] with t > N - t 
may be replaced with its complementary code C L while maintaining all distance properties 
(therefore maintaining all error- and erasure- correcting capability). 

Const ant- dimension codes are naturally described as particular vertices of a so-called Grass- 
mann graph, also called a q- Johnson scheme, where the latter name emphasizes that these 
objects constitute association schemes. A formal definition is given as follows. 

Definition 3 Denote byV(W,£) the set of all subspaces ofW of dimension £. This object 
is known as a Grassmannian. The Grassmann graph Gw,i has vertex set V(W, £) with an 
edge joining vertices U and V if and only if d(U, V) — 2. | 

Remark: It is well known that Gw,i is distance regular [21] and an association scheme with 
relations given by the distance between spaces. As such, practically all techniques for bounds 
in the Hamming association scheme apply. In particular, sphere-packing and sphere-covering 
concepts have a natural equivalent formulation. We explore these directions in Section |H 
We also note that the distance between two spaces U, V in V(W, £) introduced in (j3J) is, like 
in the case of const ant- weight codes in the Hamming metric, an even number equal to twice 
the graph distance in the Grassmann graphJl As noted Section [TJ codes in the Grassmann 
graph have been considered previously in [11-15,17]. | 

When modelling the operation of random linear network coding by the operator channel of 
Definition [TJ there is no further need to specify the precise network protocol. In particular, 
we assume the receiver knows that a codeword V from V(W, £) was transmitted. In this 
situation, a receiver could choose to collect packets until the collected packets, interpreted as 
vectors, span an ^-dimensional space. This situation would correspond to an operator channel 
of type U = TCi-t(E)(V) © E, corresponding to t(E) erasures and t(E) errors. According to 
Theorem [2] we can thus correct up to an error dimension [ D ^~ 1 J . To some extent this 
additional factor of two reflects the choice of the distance measure as being twice the graph 
distance in Gw,e- Note that this situation also would arise if the errors originated in network- 
coded transmissions through the min-cut edges in the graph. If the errors do not affect the 

2 Defimng a distance as half of d(U, V) would give non-integer values for packings in V(W). 
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min cut but may have arisen anywhere else in the network, a receiver can choose to collect 
packets until an £ + t(E) dimensional space V © E has been recoveredJl In this case the 
error correction capability would increase to an error dimension [ jP ^~ 1 J . We do not study 
the implications of this observation further in this paper, since the coding-theoretic goal of 
constructing good codes in V(W) is not affected by this. Nevertheless, we point out that a 
properly designed protocol can (and should) take advantage of these differences. 

3.5. Examples of Codes 

We conclude this section with two examples of codes in V(W, £) . 

Example 1 Let W be the vector space of iV-tuples over ¥ q . Consider the set C C V(W,£) 
of spaces U{, i = 1,2, ... , \C\ with generator matrices G(Ui) = (I\Ai) where / is an £ x £ 
identity matrix and the A\ are all possible £ x (N — £) matrices over ¥ q . It is easy to see 
that all G(Ui) generate different spaces, intersecting in subspaces of dimension at most £ — 1 
and that, hence, the minimum distance of the code is 2£ — 2{£ — 1) = 2. The code is a 
constant-dimension code of type [N,£,£(N — £),2] with normalized weight A = £/N, rate 
R = 1 — A and normalized distance 5 = v^. | 

The first example corresponds to a trivial code that offers no error protection at all. While 
this code has been advocated widely for random linear network coding it is by no means the 
optimal code for a given distance D = 2, as can be seen in the following example. 

Example 2 Again let W be the space of vectors of length N. We now choose the code 
C = V(W,£), which yields a constant-dimension code of type [N, £, \og q \V(W, £)\,2] which 
is clearly larger than the code C of Example [H As explained in Section 111 |P(W, £)\ is equal 
to the Gaussian coefficient [jf] ■ 

We note that C", defined as C" = U;=i "P^Wi ( no longer a const ant- dimension code) is 
obviously an even bigger code (albeit with minimum distance D — 1) that can be used 
for random linear network coding while not using more network resources than C and C. 
However, in contrast to C, the receiver must be able to determine when the transmission of 
the code space is complete. This information is implicit in C and C since the dimension of 
the transmitted space is fixed beforehand. | 

In the next section we provide a few standard bounds for codes in our setup. 

3 Not knowing the effective dimension of E, i.e., the dimension of E/(E n V), in practice the receiver 
would just collect as many packets as possible and attempt to reconstruct the corresponding space. 
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4. Bounds on Codes 



4.1. Preliminaries 



We will be interested in constructing constant-dimension codes. We start this section by 
introducing some notation that will be relevant for packings in V(W, £) where W is an 
iV-dimensional vector space over ¥ q . 

The q-ary Gaussian coefficient, the g-analogue of the binomial coefficient, is defined, for 
non-negative integers £ and n with £ ^ n, by 



?? 



(q n -l)(q 



n-l 



(q 



n-e+i 



W" 1 -!)••■(<?- 1) 



£-1 

n 

i=0 



9 



- 1 



..e-i 



where the empty product obtained when £ = is interpreted as 1. 



As is well known (see, e.g., [22, Ch. 24]), the Gaussian coefficient ["] gives the number of 
distinct ^-dimensional subspaces of an n-dimensional vector space over ¥ q . 

For q > 1 the asymptotic behavior of ["] is given given by the following lemma. 
Lemma 4 The Gaussian coefficient [™] satisfies 



n 



< 4 



J q 



1 < 

for < £ < n, so that we may write ["J^ = ^g" 2A ( 1 ~ A ) j , < A < 1. 

Proof. The quantity q^ n ~^ may be interpreted as the number of ^-dimensional subspaces 
of F™ that occur as the row space of a matrix of the form [I\A], where I is an £ x I identity 
matrix and A is an arbitrary £ x (n — £) matrix over ¥ q . (This is the number of codewords in 
the code C of Example [1] with iV = n.) Since £ > 0, this set does not contain all ^-dimensional 
subspaces of and hence the left hand inequality results. For the right hand inequality we 
observe that [™] may be written as 



n 



q 



t{n-t) 



J q 



< q 



l{n-€)_ 



(1 - <T n )(l - q- n+1 ) ... (1 - q-n+z- 1 ) 
1 



< q 



£(n-£) 



oo 

n - 
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The function f(x) = YlJLi (i- x j) * s ^ ne g enera ting function of integer partitions [22, Ch. 15] 
which is increasing in x. As we are interested in f(l/q) for q ^ 2, we find that 

OO -| oo 1 

nr3 F j<nr^7 = veo<4, 

i=i y i=i 

where Q ~ 0.288788095 is a probabilistic combinatorial constant (see, e.g., [23]) that gives 
the probability that a large, randomly chosen square binary matrix over F2 is nonsingular. | 

We remarked earlier that the Grassmann graph constitutes an association scheme, which 
lets us use simple geometric arguments to give the standard sphere-packing upper bounds 
and sphere-covering lower bounds. In order to establish the bounds we need the notion of a 
sphere. 

Definition 4 Let W be an N dimensional vector space and let V(W, £) be the set of £ 
dimensional subspaces of W . The sphere S(V,£,t) of radius t centered at a space V in 
V(W,£) is defined as the set of all subspaces U that satisfy d(U,V) ^ 2t, 

S(V, £, t) = {Ue V(W, £) : d(U, V) ^ 2t}. 1 



Note that we prefer to define the radius in terms of the graph distance in the Grassmann 
graph. The radius can therefore take on any non-negative integer value. 

Theorem 5 The number of spaces in S(V, £, t) is independent ofV and equals 

t 

\S(V,£,t)\ = J2^ 

i=0 

for t < £. 



t 




N-£ 


i 




i 



Proof. The claim that S(V,£, t) is independent of V follows from the fact that V(W,£) 
constitutes a distance regular graph [21]. We give an expression for the number of spaces 
U that intersect V in an £ — i dimensional subspace. We can choose the £ — % dimensional 
subspace of intersection in L_.] = [.] ways. Once this is done we can complete the subspace 
in 



(q N -q e )(q N -q i+1 )...(q 



N 



q 



(q e - q^)^ - q 1 -^ 1 ) . . . {q e - g^ 1 ) 



q' 



N — 

i 



ways. Thus the cardinality of a shell of spaces at distance 2i around V equals q %2 [ N { £ ] [^] . 
Summing the cardinality of the shells gives the theorem. I 



Note that \S(V,£,t)\ = \S(V,N- £,t)\, as expected from 
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4.2. Sphere-Packing and Sphere- Covering Bounds 



We now can simply state the sphere-packing and sphere- covering bounds as follows: 

Theorem 6 Let C be a collection of spaces in V(W,£) such that D{C) ^ 2t, and let s 
■ The size of C must satisfy 

1 \S(V,£,s)\ \S(V,£,s)\ 



Conversely, there exists a code C with distance D(C) ^ 2£ such that \C'\ is lower bounded 
by 

11 " |s(v,£,t-i)| |s(v,<,«-i)| (t - i) g e-D° [3 [~-«] 

16V 



Proof. Given the expression for the size of a sphere in V(W, £) the upper and lower bounds 
are just the familiar packing and covering bounds for codes in distance regular graphs. | 

Again we note, as a consequence of (j3J), that these bounds are symmetric in £ and N — £. 

We can express the bounds of Theorem [6] in terms of normalized parameters. 

Corollary 7 Let C be a collection of spaces in V(W,£) with normalized minimum distance 
5 = . The rate of C is bounded from above by 

R < (1 - 5/2)(l - A(l + 5/2)) + oil), 

where o(l) approaches zero as N grows. Conversely, there exists a code C with normalized 
distance 5 such that the rate of C is lower bounded as: 

(i-5)(i- A(5 + l)) + o(l), 

where again o(l) approaches zero as N grows. | 



As in the case of the Hamming scheme, the upper bound is not very good, especially since it 
easily can be seen that S cannot be larger than one. We next derive a Singleton type bound 
for packings in the Grassmann graph. 



4.3. Singleton Bound 

We begin by defining a suitable puncturing operation on codes. Suppose C is a collection of 
spaces in V(W,£), where W has dimension N. Let W be any subspace of W of dimension 
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N — 1. A punctured code C is obtained from C by replacing each space V G C by V = 
Tie-i(Y H W') where Hi-\ denotes the erasure operator defined earlier. In other words, V 
is replaced by V n W 7 if V fl W has dimension £ — 1; otherwise V is replaced by some 
— l)-dimensional subspace of V . Although this puncturing operation does not in general 
result in a unique code, we denote any such punctured code as C\w>- 

We have the following theorem. 

Theorem 8 If C C V{W,£) is a code of type [N,£,\og q \C\,D] with D > 2 and W is an 
(N — 1) -dimensional subspace ofW, then C = C\w> is a code of type [N — 1, t — 1, log 9 D'\ 
with D' ^ D-2. 

Proof. Only the cardinality and the minimum distance of C are in question. We first verify 
that D' ^ D-2. Let U and V be two codewords of C, and suppose that U' = He-i(U n W) 
and V = Ht-i{V fl W) are the corresponding codewords in C. Since U' C U and V 7 C V 
we have C/' n V C [/ n V, so that 2 dim(C/' n V ) ^ 2 dim(C/ n V) ^ 2£ - D, where the latter 
inequality follows from the property that d(U, V) = 2£ — 2dim(C/ fl V) ^ D. Now in C we 
have 

d(U',V) = dim(C/') + dim(y') - 2 dim(f/ / n V) 
= 2{l- 1) -2dim(C/'ny / ) 
^ 2£-2-(2£-£>) 
= D-2. 

Since D > 2, d(U' \ V) > 0, so [/' and V' are distinct, which shows that C has as many 
codewords as C. | 

We may now state the Singleton bound. 

Theorem 9 A q-ary code ofCC V(W, (!) of type [N, i, \og q \C\, D] must satisfy 

\N-{D-2)/2 
1 1 ^ [majt{(,N -l}\ q 

Proof. If C is punctured a total of {D-2)/ 2 times, a code C of type [N-(D-2)/2,£-(D- 
2)/2, log 9 |C|, D'] is obtained, with every codeword having dimension £—(D — 2)/2 and with 
D' ^ 2. Such a code cannot have more codewords than the corresponding Grassmannian, 
which contains a = [^I^Izj/Z] = [ N ~^N-£^ 2 ] q P°i n ^ s - Applying the same argument to C 1 - 
yields the upper bound b = [ N ~^ D e ~ 2 ^ 2 ] q - Now a < b if and only if £ < N — £, from which 
the bound follows. | 

This bound is easily expressed in terms of normalized parameters. We consider only the case 
where £ ^ N - £, i.e., A < 1/2. 
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Corollary 10 Let C be a collection of spaces in V(W,£), with i ^ dim(W / )/2 and with 
normalized minimum distance 6 = ^p- The rate of C is bounded from above by 

fl<(l-5)(l-A) + i(l-A + o(l)). 

The three bounds are depicted in Fig. [TJ for A = 1/4 and in the limit as iV — ► oo. 

A = 1/4 




0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 2 

normalized distance 5 



Figure 1: Upper and lower asymptotic bounds on the largest rate of a code in the Grassmann 
graph Gwi where the dimension N of ambient vector space is asymptotically large and A = -4 
is chosen as 1/4. 



5. A Reed-Solomon-like Code Construction and Decod- 
ing Algorithm 

We now turn to the problem of constructing a code capable of correcting errors and era- 
sures at the output of the operator channels defined in Section [2j The code construction 
is equivalent to that given by Wang, Xing and Safavi-Naini [17] in the context of linear 
authentication codes, which in turn can be regarded as an application of the maximum 
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rank-distance construction of Gabidulin [18]. (The connection between constant-dimension 
codes and rank-metric codes and the generalized rank-metric decoding problem induced by 
the operator channel is studied in detail in [20].) The main contribution of this section is a 
Sudan-style "list- 1" minimum distance decoding algorithm, given in Section [5731 

5.1. Linearized Polynomials 

Let F q be a finite field and let F = ¥ q m be an extension field. Recall from [24, Ch. 11], [25, 
Sec. 4.9], [26, Sec. 3.4] that a polynomial L(x) is called a linearized polynomial over F if it 
takes the form 

d 

L(x) = J2^ q \ (6) 

i=0 

with coefficients ai G F, i = 0, . . . , d. If all coefficients are zero, so that L(x) is the zero 
polynomial, we will write L(x) = 0; more generally, we will write L\(x) = L 2 {x) if L\{x) — 
L 2 {x) = 0. When q is fixed under discussion, we will let denote x q% . In this notation, a 
linearized polynomial over F may be written as 

d 

L(x) = J2 a i xii] - 

If Li(x) and L 2 (x) are linearized polynomials over F, then so is any F-linear combination 
a.\L\(x) + a 2 L 2 (x), a\,a 2 G F. The ordinary product Li(x)L 2 (x) is not necessarily a 
linearized polynomial. However, the composition Li(L 2 (x)), often written as L\(x) ®L 2 (x), 
of two linearized polynomials over F is again a linearized polynomial over F. Note that this 
operation is not commutative, i.e., Li(x) <S> L 2 (x) need not be equal to L 2 (x) ® L\(x). 

The product L x {x) ® L 2 (x) of linearized polynomials is computed explicitly as follows. If 

L\{x) = J2i^o a i x[t] and L 2 (x) = J^j^objX^, then 

L x {x)®L 2 {x) = L 1 (L 2 (x) = ^a i (L 2 (x))W 




= J2J2 a * b f x[l+1] = J2 Ckx[k] 

where 

k 

c k = J2 aib k-i- 

i=0 

Thus the coefficients of L\{x) ® L 2 (x) are obtained from those of L\{x) and L 2 (x) via a 
modified convolution operation. If Li(x) has degree q dl and L 2 (x) has degree q d2 , then both 
L\{x) ® L 2 (x) and L 2 (x) ® L\(x) have degree q dl+d2 . 
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Under addition + and composition ®, the set of linearized polynomials over F forms a 
non-commutative ring with identity. Although non-commutative, this ring has many of the 
properties of a Euclidean domain including, for example, an absence of zero-divisors. The 
degree of a nonzero element forms a natural norm. There are two division algorithms: a left 
division and a right division, i.e., given any two linearized polynomials a(x) and b(x), it is 
easy to prove by induction that there exist unique linearized polynomials qn(x), r L (x) 

and tr{x) such that 

a ( x ) — Ql{x) <g> b(x) + r L (x) = b(x) <g> qii(x) + r R (x), 

where r L (x) = or deg(r L (x)) < deg(b(x)) and similarly where r R (x) = or deg(r R (a;)) < 
deg(6(a:)). 

The polynomials qn(x) and rp>(x) are easily determined by the following straightforward 
variation of ordinary polynomial long division. Let \c(a(x)) denote the leading coefficient of 
a(x), so that if a(x) has degree q d , i.e., a(x) = a d x^ + a^-i^ -1 ' + • • • + a x^ with a d ^ 0, 
then lc(a(x)) = ad- 
procedure KDiv(a(x),b(x)) 

input: a pair a(x), b(x) of linearized polynomials over F = F™, with b(x) ^ 0. 
output: a pair q(x),r(x) of linearized polynomials over F™ 
begin 

if deg(a(x)) < deg(b(x)) then 

return (0, a(x)) 
else 

d := deg(a(x)), e := deg(b(x)), a d := \c(a(x)), b e := lc(b(x)) 
t(x) := (a d /b e Y m - e h^ (*) 
return (t(x), 0) + RDiv(a(x) - b(x) ® t(x), b(x)) (**) 
endif 

end 

Note that the parameter m in step (*) is equal to the dimension of F™ as a vector space 
over W q . This algorithm terminates when it produces polynomials q(x) and r(x) with the 
property that a(x) = b(x) <E> q(x) + r(x) and either r(x) = or degr(x) < deg6(x). 

The left-division procedure is essentially the same; "RDiv" is replaced with "LDiv" and (*) 
and (**) are replaced with the following: 

t(x) := (a d /(b [ t e] ))x^ 

return (t(x),0) + LDiv(a(x) - t(x) <g> b(x), b(x)) 

With this change, the algorithm terminates when it produces polynomials q(x) and r(x) 
with the property that a(x) = q(x) <g> b(x) + r(x). 
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Linearized polynomials receive their name from the following property. Let L(x) be a lin- 
earized polynomial over F, and let K be an arbitrary extension field of F. Then K may be 
regarded as a vector space over ¥ q . The map taking f3 G K to L(j3) G K is linear with 
respect to ¥ q , i.e., for all /?i,/3 2 G K and all Ai, A2 G F 9 , 

L(Aift + A 2/ 3 2 ) = AiL(/3i) + A 2 L(/? 2 ). 

Suppose that .fT is chosen to be large enough to include all the zeros of L(x). The zeros of 
L(x) then correspond to the kernel of L(x) regarded as a linear map, so they form a vector 
space over ¥ q . If L(x) has degree q d , this vector space has dimension at most d, but the 
dimension could possibly be smaller if L(x) has repeated roots (which occurs if and only if 
a = in ©). 

On the other hand if V is an n-dimensional subspace of K, then 

L(x) = l[(x - (3) 

is a monic linearized polynomial over K (though not necessarily over F). See [25, Lemma 
21] or [26, Theorem 3.52]. 

The following lemma shows that if two linearized polynomials of degree at most agree 
on at least d linearly independent points, then the two polynomials coincide. 

Lemma 11 Let d be a positive integer and let f(x) and g(x) be two linearized polynomials 
over F of degree less than q d . If oti, a 2 , . . . , ad are linearly independent elements of K such 
that have /(aij) = g{oii) for i — 1, . . . , d, then f(x) = g(x). 

Proof. Observe that h(x) = f(x) — g(x) has a%, . . . , ad as zeros, and hence also has all 
q d linear combinations of these elements as zeros. Thus h(x) has at least q d distinct zeros. 
However, since the actual degree of h(x) is strictly smaller than q d , this is only possible if 
h(x) = 0. 1 

5.2. Code Construction 

Just as traditional Reed-Solomon codeword components may be obtained via the evaluation 
of an ordinary message polynomial, we obtain here a basis for the transmitted vector space 
via the evaluation of a linearized message polynomial. 

Let W q be a finite field, and let F = ¥ qm be a (finite) extension field of ¥ q . As in the 
previous subsection, we may regard F as a vector space of dimension m over ¥ q . Let A = 
{«!,..., at) C F be a set of linearly independent elements in this vector space. These 
elements span an ^-dimensional vector space (A) C F over ¥ g . Clearly i ^ m. We will take 
as ambient space the direct sum W = (A) ©F = {(a, ft) : a G (A), (3 G F}, a vector space of 
dimension I + m over ¥ q . 
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Let u = (uo, Mi, ... , Mfc-i) £ denote a block of message symbols, consisting of k symbols 
over F or, equivalently, mk symbols over ¥ q . Let ¥ k [x] denote the set of linearized polynomials 
over F of degree at most q k ~ 1 . Let f(x) G F fe [x], defined as 

fe-i 

i=0 

be the linearized polynomial with coefficients corresponding to u. Finally, let fa = f(di). 
Each pair % = 1, . . . , £, may be regarded as a vector in W. Since {a>i, . . . , ag} is a 

linearly independent set, so is {(ai,Pi), . . . , (ag, fa)}] hence this set spans an ^-dimensional 
subspace V of W. We denote the map that takes the message polynomial f(x) G ¥ k [x] to 
the linear space V G V(W, \A\) as ev^. 

Lemma 12 If\A\ ^ k then the map ev^ : ¥ k [x] — > V(W, \A\) is injective. 

Proof. Suppose \A\ ^ k and ev^(/) = ev^g) for some f(x),g(x) G F fc [x]. Let h(x) = 
f(x) — g(x). Clearly h{a.j) = for i = !,...,£. Since h(x) is a linearized polynomial, it 
follows that h(x) = for all x G (A). Thus h(x) has at least g'" 4 ' ^ g fc zeros, which is only 
possible (since h(x) has degree at most g fe_1 ) if h(x) = 0, so that f(x) = g(x). | 

Henceforth we will assume that £ ^ k. Lemma [12] implies that, provided this condition 
is satisfied, the image of ¥ h [x] is a code C C V(W,£) with g mfc codewords. The minimum 
distance of C is given by the following theorem; however, first we need the following lemma. 

Lemma 13 If {(«i, fa), . . . , (a r , /3 r )} C W is a collection ofr linearly independent elements 
satisfying fa = f{otj) for some linearized polynomial f over ¥, then {ati, . . . , a r } is a linearly 
independent set. 

Proof. Suppose that for some 71, .. .,j r G ¥ q we have Y^i=ili a i = 0- Then, in W, we 
would have 

r / r r \ / r \ / / r 

7 i (a i , A) = I 7i«<> I = ( °> S I = ( °' / ( S li(Xi 

i=l \i=l i=l J \ i=l J \ \i=l 

= (0,/(0)) = (0,0), 

which is possible (since the (at*, pairs are linearly independent) only if 71, . . . , j r — 0. | 

Theorem 14 Let C be tie image under ev^ of F fc [x], with I = \A\ ^ fc. Then C is a code of 
type [£ + m,£,mk,2(£- k + 1)]. 

Proof. Only the minimum distance is in question. Let f(x) and g(x) be distinct elements 
of F fe [x], and let U = ev^(/) and = ev^(g). Suppose that f/flF has dimension r. This 
means it is possible to find r linearly independent elements (at'i,P[), • • • , (a' r ,fa r ) such that 
/(ojQ = gice'j) = i = 1, . . . , r. By Lemma [13l a^, . . . , a' r are linearly independent and 
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hence they span an r- dimensional space B with the property that f(b) — g(b) = for all 
b G B. If r ^ k then f(x) and would be two linearized polynomials of degree less than 
q k that agree on at least k linearly independent points, and hence by Lemma [IT], we would 
have f{x) = g(x). Since this is not the case, we must have r ^ k — 1. Thus 

d(U, V) = dim([7) + dim(V) - 2 dim(C/ nV) = 2{£ — r)^2(£-k + 1). 

It is easy to exhibit two codewords Z7 and V that satisfy this bound with equality. | 

The Singleton bound, evaluated for the code parameters of Theorem [TU states that 

IN — (D — 2) /2~ 



ICI ^ 





m + k 


- 9 


k 



< 4q 



ink 



This implies that a true Singleton-bound-achieving code could have no more than 4 times 
as many codewords as C. When N is large enough, the difference in rate between C and a 
Singleton-bound-achieving becomes negligible. Indeed, in terms of normalized parameters, 
we have 

R = (1 - A)(l -5 + 



1_ 



which certainly has the same asymptotic behavior as the Singleton bound in the limit as 
A^ — > oo. We claim, therefore, that these Reed-Solomon-like codes are nearly Singleton- 
bound-achieving. 

We note also that the traditional network code C of Example [fl a code of type [m+£, £, m£, 2], 
is obtained as a special case of these codes by setting k — £. 

This code construction involving the evaluation of linearized polynomials is clearly closely 
related to the rank-metric code construction of Gabidulin [18]. However, in our setup, the 
codewords are not arrays, but rather the vector spaces spanned by the rows of the array, and 
the relevant decoding metric is not the rank metric, but rather the distance measure defined 
in ([3]). The connection between subspace codes and rank- metric codes is explored further 
in [20]. 



5.3. Decoding 

Suppose now that V G C is transmitted over the operator channel described in Section [2] and 
that an {£ — p + t) -dimensional subspace U of W is received, where dim(?7 PI V) = I — p. In 
this situation, we have p erasures and an error norm of t, and d(U, V) = p + t. We expect to 
be able to recover V from U provided that p + t<D/2 = £ — k + 1, and we will describe a 
Sudan-style "list-1" minimum distance decoding algorithm to do so (see, e.g., [27, Sec. 9.3]). 
Note that, even if t = 0, we require p < £ — k + 1, ox £ — p ^ k, i.e., not surprisingly (given 
that we are attempting to recover mk information symbols), the receiver must collect enough 
vectors to span a space of dimension at least k. 
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Let r = £ — p-\-t denote the dimension of the received space U, and let (xj, yj),z = l,...,r be 
a basis for U . At the decoder we suppose that it is possible to construct a nonzero bivariate 
polynomial Q(x,y) of the form 

Q(x, y) = Q x (x) + Q y (y), such that Q{x h yi) = for i = 1, ... ,r, (7) 

where Q x (x) is a linearized polynomial over ¥ qm of degree at most q T ~ l and Q y {y) is a lin- 
earized polynomial over ¥ q m of degree at most q T ~ k . Although Q(x, y) is chosen to interpolate 
only a basis for U, since Q(x, y) is a linearized polynomial, it follows that in fact Q(x, y) = 
for all (x, y) G U . 

We note that ([7]) defines a homogeneous system of r equations in 2r — k + 1 unknown 
coefficients. This system has a nonzero solution when it is under-determined, i.e., when 

r = £-p + t<2T-k + l. (8) 

Since f(x) is a linearized polynomial over F g m, so is Q(x, /(x)), given by 

Q(x, f(x)) = Q x (x) + Q y (/(z)) = Q x {x) + Q y (x) ® /(x). 

Since the degree of /(x) is at most g fc_1 , the degree of Q(x, f(x)) is at most q T ~ 1 . 

Now let {(ai, &i), . . . , (a^_ p , be a basis for [/ n V. Since all vectors of U are zeros of 

Q(x, y), we have Q(a i5 6j) = for i = 1, ...,£ — p. However, since (aj, &j) G V we also have 
6j = /(aj) for i = 1, ...,£ — p. In particular, 

Q(a h h) = Q{a h /(aj)) = 0, z = 1, ...,£- p, 

thus Q(x, /(x)) is a linearized polynomial having ai, . . . , a^_ p as roots. By Lemma [T3"| these 
roots are linearly independent. Thus Q(x, f(x)) is a linearized polynomial of degree at most 
q T ~ 1 that evaluates to zero on a space of dimension £ — p. If the condition 

£-P>t (9) 

holds, then Q(x, /(x)) has more zeros than its degree, which is only possible if Q(x, /(x)) = 0. 
Since in general 

Q(x,y) = Q y (y-f(x)) + Q(xJ(x)), 
we have, when Q(x, /(x)) = 0, 

Q(x,y) = - /(x)) 

and so we may hope to extract y — /(x) from Q(x,y). Equivalently, we may hope to find 
/(x) from the equation 

Q„(z) ® /(x) + Q^x) = 0. (10) 

However, this equation is easily solved using the RDiv procedure described in Section 15. H 
with a(x) = —Q x (x) and b(x) = Q y (x). Alternatively, we can expand fllOp into a system of 
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equations involving the unknown coefficients of f(x); this system is readily solved recursively 
(i.e., via back-substitution). 

In summary, to find nonzero Q(x, y) we must satisfy (jSj) and to ensure that Q(x, f(x)) = 
we must satisfy When both (|Sj) and (jSJ) hold for some r, we say that the received space 
U is decodable. 

Suppose that the received space U is decodable. Substituting (Q into (JSj), we obtain the 
condition £ — p + t < 2(£ — p) — A; + 1 or, equivalently, 

p + t<^-Jfe + l, (11) 

i.e., not surprisingly decodability implies ffTTT) . 

Conversely, suppose (iTTj) is satisfied. From (jTTI) we get £ — p ^ £ + k, or 

£-p + t + A; = r + A;^2(£-p). (12) 

By selecting 

r r + fc-, 
1 2 1 

(which is possible to do since the receiver knows both r and k), we satisfy (jBJ). With this 
choice of r, and applying condition (fl2"l) . we see that 

r ^ £-p + 1/2; 

however, since £, p and r are integers, we see that ([9]) is also satisfied. In other words, 
condition (TTTT) implies decodability, which is precisely what we would have hoped for. 

The interpolation polynomial Q(x,y) can be obtained from the r basis vectors (xi,yi), 
(^2,2/2), • {%r,yr) for U via any method that provides a nonzero solution to the ho- 
mogeneous system (jTj). We next describe an efficient algorithm to accomplish this task. 
This algorithm is closely related to the work of Loidreau [19], who provides a polynomial- 
reconstruction-based procedure for rank-metric decoding of Gabidulin codes. 

Let f(x,y) = f x (x) + f y (y) be a bivariate linearized polynomial, which means that both 
f x (x) and f y (y) are linearized polynomials. Let the degree of f x (x) and f y (y) be q dx ^ and 
q d v(f) ) respectively. The (1, k — l)-weighted degree of f(x, y) is defined as 

deg l k _ 1 (f(x, y)) := max{4(/), k - 1 + d y (f)} 

Note that this definition is different from the weighted degree definitions for usual bivariate 
polynomials. However, it should become more natural by observing that we may write f(x, y) 
as f(x, y) = f x (x) + f y (x) ® y. 

The following adaptation of an algorithm for the interpolation problem in Sudan-type de- 
coding algorithms (see e.g. [28,29]) provides an efficient way to find the required bivariate 
linearized polynomial Q(x,y). Let a vector space U be spanned by r linearly independent 
points (Xi,yi) e W. 
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procedure Interpolate^) 

input: a basis (xj, yi) G W, i = 1, . . . , r, for [/ 
output : a linearized bivariate polynomial Q(x, y) = Q x (x) + Q y (y) 
initialization: fo(x,y) = x, fi(x,y) = y 
begin 

for % = 1 to r do 

A := fo(xi,yi); A x := /ifo,^) 
if A = then 

elseif Ai = then 

/o(z,y) := /o(^,y) - Ag'Vofos/) 

else 

if de gi,fc-i(/o) ^ degi, k -i(fi) tnen 
fi(x,y) := A 1 f (x,y) - A /i(a;,y) 

/o(z,y) := /o(z,J/) - Ag -1 /o(z,J/) 
else 

/o(x, y) := Ai/ (x, y) - A /i(x, y) 
Afoy) :=f q 1 (x,y)-Ar 1 f 1 (x,y) 

endif 
endf or 

if de gi,fc-i(A) < de gi,fc-i(/o) then 

return fi(x,y) 
else 

return f (x,y) 
endif 

end 

For completeness we provide a proof of correctness of this algorithm, which mimics the proof 
in the case of standard bivariate interpolation, finding the ideal of polynomials that vanishes 
at a given set of points [28,29]. 

Define an order -< on bivariate linearized polynomials as follows: write f(x,y) -< g(x,y) 
if deg 1)fc _!(/(a:,j/)) < deg l k ^(g(x,y)). In case deg 1)fc _ 1 (/(x,j/)) = deg l k ^(g(x,y)) write 
f(x, y) -< g(x, y) if d y (f) +k — l< deg lk _ 1 (f(x, y)) and d y (g) + k - 1 = deg 1>fc _ 1 (y(a:, y)). If 
none of these conditions is true, we say that f(x, y) and g(x, y) are not comparable. While -< 
is clearly not a total order on polynomials, it is granular enough for the proof of correctness 
of procedure Interpolate. In particular, -< gives a total order on monomials and we can, 
hence, define a leading term lt^(/) as the maximal monomial (without its coefficient) in / 
under the order -<. 

Lemma 15 Assume that we have two bivariate linearized polynomials f(x,y) and g(x,y) 
which are not comparable under -<. We can create a linear combination h(x,y) = f(x,y) + 
■yg(x, y) which for a suitably chosen 7 yields a polynomial h(x, y) with h(x, y) -< f(x, y) and 
h(x,y) -< g(x,y). 
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Proof. If f(x,y) and g(x,y) are not comparable then we have lt^(/) = lt^(y). Choosing 
7 as the quotient of the corresponding coefficients of lt^(/) in / and lt^(y) in g yields a 
polynomial h(x,y) such that lt^(/i) -< lt^(/) = lt^(g). | 

Let A be a set of r linearly independent points (xi,yi) G W. We say that a nonzero polyno- 
mial f(x, y) is x-minimal with respect to A if f(x, y) is a minimal polynomial under -< such 
that lt^(/) = x^ dx ^ and f(x,y) vanishes at all points of A. Similarly, a nonzero polynomial 
g(x,y) is said to be y-minimal with respect to A if g(x,y) is a a minimal polynomial under 
-< such that lt^(y) = y^^l and g(x,y) vanishes in all points of A. 

Theorem 16 The polynomials fo(x, y) and f\ (x, y) that are output by procedure Interpolate 
are x-minimal and y-minimal with respect to the given set of r linearly independent points 
(Xi,yi) G W. 

Proof. First we note that x-minimal and y-minimal polynomials can always be compared 
under -< since they have different leading monomials. The proof proceeds by induction. 
We first verify that the polynomials x and y are x-minimal and y-minimal with respect to 
the empty set. We thus assume that after j iterations of the interpolation algorithm the 
polynomials /o(x, y) and fi(x,y) are x-minimal and y-minimal with respect to the points 
(xi,yi), i — 1, 2, . . . ,j. It is easy to check that the set of polynomials constructed in the 
next iteration also vanishes at the point (xj + i,yj + i) so this part of the definition of x- and 
y-minimality with respect to points (xj, yi), i = 1, 2, . . . , j + 1 will not be a problem. 

Assume first the generic case that A ^ and Ai ^ 0. Assume that f±(x,y) -< / (x, y) 
holds. Let fd(x,y) = Ai/ (x,y) - A /i(x,y). In this case ^(/^(x,y)) = lt^(f (x,y)) 
and the x- minimality of /q(x, y) follows from the x-minimality of fo(x,y). Let f[(x,y) = 
fi(x, y) — A\~ 1 fi(x, y). We will show that f[(x, y) is y-minimal with respect to points (xj, y^), 
% = 1, 2, . . . , j + 1. To this end and in order to arrive at a contradiction assume that f[(x, y) 
is not y-minimal. This would imply that there exists a y-minimal polynomial f"(x,y) w.r.t. 
points (xi,yi), i = 1, 2, . . . , j + 1 such that f"(x,y) ^ f\(x,y) which has the same leading 
term as f\(x,y). The two polynomials are clearly different since f"(x,y) would vanish at 
(xj + i,yj + i) while /i(x, y) does not. But this would imply that we can find a polynomial 
h(x,y) as linear combination of f"(x,y) and /i(x, y) which would precede both / (x, y) and 
/i(x, y) under the order -< and which would vanish at all points (xj, y^), i = 1,2, ... ,j, thus 
contradicting the minimality of / (x, y) and fi(x, y). A virtually identical arguments holds 
if we have fo(x,y) -< fi(x,y). 

Next we consider the case that A equals while we have Ai ^ 0. In this case / (x, y) is 
unchanged and, hence, inherits its x-minimality from the previous iteration. We only have 
to check that the newly constructed f[(x,y) = ff(x,y) — A1~ 1 fi(x, y) is y-minimal with 
respect to points (xj, yi), i — 1, 2, . . . , j + 1. Again, assuming the opposite would imply that 
there exists a polynomial f"(x,y) ^ fi(x, y) with the same leading term as /i(x, y). The 
two polynomials are again different since f"(x,y) would vanish at (xj+i, y/+i) while /i(x, y) 
does not. Again, we form a suitable linear combination h(x,y) of f'{{x,y) and f\(x,y) 
which would precede f±(x, y) under -<. If the leading term of h(x,y) is of type y^Wl or 
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h(x,y) -< fo(x,y) we have arrived at a contradiction negating the ^-minimality of fi(x,y) 
or the x-minimality of f (x,y). Otherwise, note that h(x,y) does not vanish at (xj + i,yj + %) 
and hence is not a multiple (under Cg> of fo(x, y).) Hence, for a suitably chosen t, we can find 
a polynomial h"(x,y) as a linear combination of h(x,y) and x^ ® fo(x,y) which precedes 
h(x, y). Repeating this procedure we arrive at a polynomial h(x, y) which either has a leading 
term of type y^Wl or which precedes fo(x, y) under -<, either contradicting the ^/-minimality 
of fi(x, y) or the x-minimality of fo(x, y). Finally we note that the case A 7^ and Ai = 
follows from similar arguments. For the case Ao = and Ai = there is nothing to prove. | 

Based on Theorem [161 we can claim that the Interpolate procedure solves the problem — as 
required in equation ([7]) — of finding the bivariate linearized polynomial Q(x,y) of minimal 
(1, k — 1) weighted degree r — 1, which is identified as the polynomial fo(x,y) or fi(x,y) of 
smaller (1, k — 1) weighted degree. 

Let V G C be transmitted over the operator channel described in Section [2] and assume that 
an (£ — p + t) -dimensional subspace U of W is received. Decoding comprises the following 
steps: 

1. Invoke Interpolate^) to find a bivariate linearized polynomial Q(x,y) = Q x {x) + 
Q y {y) of minimal (1, k — 1) weighted degree that vanishes on the vector space U. 

2. Invoke RDiv(— Q x (x), Q y (x)) to find a linearized polynomial f(x) with the property 
that — Q x (x) = Q y (x) <g> f(x). If no such polynomial can be found declare "failure." 

3. Output f(x) as the information polynomial corresponding the codeword V G C if 
d(U,V) <£-k + l. 

The time-complexity of this procedure is dominated by the Interpolate step, which requires 
0((£ + m) 2 ) operations in F ? ™. 



6. Conclusions 

In this paper we have defined a class of operator channels as the natural transmission models 
in "noncoherent" random linear network coding. The inputs and outputs of operator chan- 
nels are subspaces of some given ambient vector space. We have defined a coding metric 
on these subspaces which gives rise to notions of erasures (dimension reduction) and errors 
(dimension enlargement). In defining codes, it is natural to consider constant-dimension 
codes; in this case, the code forms a subset of a finite-field Grassmannian. Sphere-packing 
and sphere-covering bounds as well as a Singleton- type bound are obtained in this context. 
Finally, a Reed-Solomon-like code construction (equivalent to the construction of linear au- 
thentication codes in [17]) is given, and a Sudan-style "list-1" unique decoding algorithm is 
described, resulting in codes that are capable of correcting various combinations of errors 
and erasures. 



27 



Acknowledgments 



The authors wish to thank Ian F. Blake and especially Danilo Silva for useful comments on 
an earlier version of this paper. 



References 

[1] T. Ho, R. Koetter, M. Medard, D. Karger, and M. Effros, "The benefits of coding over 
routing in a randomized setting," in Proc. 2003 IEEE Int. Symp. on Inform. Theory, 
(Yokohama), p. 442, June 29 - July 4, 2003. 

[2] P. A. Chou, Y. Wu, and K. Jain, "Practical network coding," in Proc. 2003 Allerton 
Conf. on Commun., Control and Computing, (Monticello, IL), Oct. 2003. 

[3] T. Ho, M. Medard, R. Koetter, D. Karger, M. Effros, J. Shi, and B. Leong, "A random 
linear network coding approach to multicast," IEEE Trans, on Inform. Theory, vol. 52, 
pp. 4413-4430, Oct. 2006. 

[4] L. Zheng and D. N. C. Tse, "Communication on the Grassmannian manifold: A geomet- 
ric approach to the noncoherent multiple-antenna channel," IEEE Trans, on Inform. 
Theory, vol. 48, pp. 359-383, Feb. 2002. 

[5] N. Cai and R. W. Yeung, "Network coding and error correction," in Proc. 2002 IEEE 
Inform. Theory Workshop, pp. 119-122, Oct. 20-25, 2002. 

[6] R. W. Yeung and N. Cai, "Network error correction, Part I: Basic concepts and upper 
bounds," Comm. in Inform, and Systems, vol. 6, no. 1, pp. 19-36, 2006. 

[7] N. Cai and R. W. Yeung, "Network error correction, Part II: Lower bounds," Comm. 
in Inform, and Systems, vol. 6, no. 1, pp. 37-54, 2006. 

[8] Z. Zhang, "Linear network error correction codes in packet networks," IEEE Trans, on 
Inform. Theory, vol. 54, pp. 209-219, Jan. 2008. 

[9] S. Jaggi, M. Langberg, S. Katti, T. Ho, D. Katabi, and M. Medard, "Resilient network 
coding in the presence of Byzantine adversaries," in Proc. 26th IEEE Int. Conf. on 
Computer Commun., INFOCOM, (Anchorage, AK), pp. 616-624, May 2007. 

[10] S. Jaggi and M. Langberg, "Resilient network codes in the presence of eavesdropping 
Byzantine adversaries," in Proc. 2007 IEEE Int. Symp. on Inform. Theory, (Nice, 
France), June 24 - June 29, 2007. 

[11] P. V. Ceccherini, "A g-analogous of the characterization of hypercubes as graphs," J. 
of Geometry, vol. 22, pp. 57-74, 1984. 



28 



[12] L. Chihara, "On the zeros of the Askey- Wilson polynomials, with applications to coding 
theory," SI AM J. Math. Anal, vol. 18, no. 1, pp. 191-207, 1987. 

[13] W. J. Martin and X. J. Zhu, "Anticodes for the Grassmann and bilinear forms graphs," 
Designs, Codes and Cryptography, vol. 6, pp. 73-79, 1995. 

[14] R. Ahlswede, H. K. Aydinian, and L. H. Khachatrian, "On perfect codes and related 
concepts," Designs, Codes and Cryptography, vol. 22, pp. 221-237, 2001. 

[15] M. Schwartz and T. Etzion, "Codes and anticodes in the Grassmann graph," J. of 
Combin. Theory Series A, vol. 97, pp. 27-42, 2002. 

[16] S.-T. Xia and F.-W. Fu, "Johnson type bounds on constant dimension 
codes." Submitted to Designs, Codes, and Cryptography. Available online at 
arxiv.org/abs/1709.1074., Sept. 2007. 

[17] H. Wang, C. Xing, and R. Safavi-Naini, "Linear authentication codes: Bounds and 
constructions," IEEE Trans, on Inform. Theory, vol. 49, pp. 866-872, Apr. 2003. 

[18] E. M. Gabidulin, "Theory of codes with maximal rank distance," Problems of Informa- 
tion Transmission, vol. 21, pp. 1-12, July 1985. 

[19] P. Loidreau, "A Welch-Berlekamp like algorithm for decoding Gabidulin codes," in 
Int. Workshop on Coding and Cryptography, WCC 2005 (0. Ytrehus, ed.), no. 3969 in 
Lecture Notes in Computer Science, Springer Verlag, 2006. 

[20] D. Silva, F. R. Kschischang, and R. Koetter, "A rank-metric approach to error-control 
in random network coding." Submitted to IEEE Trans, on Inform. Theory. Available 
online at http://arxiv.org/abs/0711.0708, 2007. 

[21] A. E. Brouwer, A. M. Cohen, and A. Neumaier, Distance- Regular Graphs. New York, 
NY: Springer Verlag, 1989. 

[22] J. H. van Lint and R. M. Wilson, A Course in Combinatorics. Cambridge, UK: Cam- 
bridge University Press, second ed., 2001. 

[23] E. R. Berlekamp, "The technology of error-correcting codes," Proc. IEEE, vol. 68, 
pp. 564-593, May 1980. 

[24] E. R. Berlekamp, Algebraic Coding Theory. New York: McGraw-Hill, 1968. 

[25] F. J. MacWilliams and N. J. A. Sloane, The Theory of Error- Correcting Codes. New 
York: North Holland, 1977. 

[26] R. Lidl and H. Niederreiter, Finite Fields. Reading, MA: Addison- Wesley, 1983. Vol. 20 
of The Encyclopedia of Mathematics, G.-C. Rota, Ed. 

[27] R. M. Roth, Introduction to Coding Theory. Cambridge, UK: Cambridge University 
Press, 2006. 



29 



[28] R. J. McEliece, "The Guruswami- Sudan decoding algorithm for Reed-Solomon codes," 
tech. rep., JPL Interplanetary Network Progress Report 42-153, 2003. Available online 
at www. systems . caltech. edu/EE/Faculty/r jm/papers/RSD-JPL .pdf . 

[29] R. J. McEliece, B. Wang, and K. Watanabe, "Koetter interpolation over modules," in 
Proc. 2005 Allerton Conf. on Commun., Control and Computing, (Monticello, IL), Oct. 
2005. 



30 



